diff --git a/docker/.env.example b/docker/.env.example
index 7bb07ebef7..2f6f896b0f 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -291,4 +291,8 @@ GID='1000'
 
 # Disable viewing chat history from the UI and frontend APIs.
 # See https://docs.anythingllm.com/configuration#disable-view-chat-history for more information.
-# DISABLE_VIEW_CHAT_HISTORY=1
\ No newline at end of file
+# DISABLE_VIEW_CHAT_HISTORY=1
+
+# Enable simple SSO passthrough to pre-authenticate users from a third party service.
+# See https://docs.anythingllm.com/configuration#simple-sso-passthrough for more information.
+# SIMPLE_SSO_ENABLED=1
\ No newline at end of file
diff --git a/frontend/src/App.jsx b/frontend/src/App.jsx
index 94b6d444df..c5ddf965cb 100644
--- a/frontend/src/App.jsx
+++ b/frontend/src/App.jsx
@@ -9,6 +9,7 @@ import PrivateRoute, {
 import { ToastContainer } from "react-toastify";
 import "react-toastify/dist/ReactToastify.css";
 import Login from "@/pages/Login";
+import SimpleSSOPassthrough from "@/pages/Login/SSO/simple";
 import OnboardingFlow from "@/pages/OnboardingFlow";
 import i18n from "./i18n";
 
@@ -80,6 +81,8 @@ export default function App() {
               <Routes>
                 <Route path="/" element={<PrivateRoute Component={Main} />} />
                 <Route path="/login" element={<Login />} />
+                <Route path="/sso/simple" element={<SimpleSSOPassthrough />} />
+
                 <Route
                   path="/workspace/:slug/settings/:tab"
                   element={<ManagerRoute Component={WorkspaceSettings} />}
diff --git a/frontend/src/components/LLMSelection/AwsBedrockLLMOptions/index.jsx b/frontend/src/components/LLMSelection/AwsBedrockLLMOptions/index.jsx
index 00f44a35ff..569ec4395b 100644
--- a/frontend/src/components/LLMSelection/AwsBedrockLLMOptions/index.jsx
+++ b/frontend/src/components/LLMSelection/AwsBedrockLLMOptions/index.jsx
@@ -1,7 +1,12 @@
 import { ArrowSquareOut, Info } from "@phosphor-icons/react";
 import { AWS_REGIONS } from "./regions";
+import { useState } from "react";
 
 export default function AwsBedrockLLMOptions({ settings }) {
+  const [useSessionToken, setUseSessionToken] = useState(
+    settings?.AwsBedrockLLMConnectionMethod === "sessionToken"
+  );
+
   return (
     <div className="w-full flex flex-col">
       {!settings?.credentialsOnly && (
@@ -24,6 +29,43 @@ export default function AwsBedrockLLMOptions({ settings }) {
         </div>
       )}
 
+      <div className="flex flex-col gap-y-2">
+        <input
+          type="hidden"
+          name="AwsBedrockLLMConnectionMethod"
+          value={useSessionToken ? "sessionToken" : "iam"}
+        />
+        <div className="flex flex-col w-full">
+          <label className="text-white text-sm font-semibold block mb-3">
+            Use session token
+          </label>
+          <p className="text-white/50 text-sm">
+            Select the method to authenticate with AWS Bedrock.
+          </p>
+        </div>
+        <div className="flex items-center justify-start gap-x-4 bg-zinc-900 p-2.5 rounded-lg w-fit">
+          <span
+            className={`text-sm ${!useSessionToken ? "text-white" : "text-white/50"}`}
+          >
+            IAM
+          </span>
+          <label className="relative inline-flex items-center cursor-pointer">
+            <input
+              type="checkbox"
+              className="sr-only peer"
+              checked={useSessionToken}
+              onChange={(e) => setUseSessionToken(e.target.checked)}
+            />
+            <div className="w-11 h-6 bg-zinc-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-primary-button"></div>
+          </label>
+          <span
+            className={`text-sm ${useSessionToken ? "text-white" : "text-white/50"}`}
+          >
+            Session Token
+          </span>
+        </div>
+      </div>
+
       <div className="w-full flex items-center gap-[36px] my-1.5">
         <div className="flex flex-col w-60">
           <label className="text-white text-sm font-semibold block mb-3">
@@ -59,6 +101,25 @@ export default function AwsBedrockLLMOptions({ settings }) {
             spellCheck={false}
           />
         </div>
+        {useSessionToken && (
+          <div className="flex flex-col w-60">
+            <label className="text-white text-sm font-semibold block mb-3">
+              AWS Bedrock Session Token
+            </label>
+            <input
+              type="password"
+              name="AwsBedrockLLMSessionToken"
+              className="border-none bg-zinc-900 text-white placeholder:text-white/20 text-sm rounded-lg focus:outline-primary-button active:outline-primary-button outline-none block w-full p-2.5"
+              placeholder="AWS Bedrock Session Token"
+              defaultValue={
+                settings?.AwsBedrockLLMSessionToken ? "*".repeat(20) : ""
+              }
+              required={true}
+              autoComplete="off"
+              spellCheck={false}
+            />
+          </div>
+        )}
         <div className="flex flex-col w-60">
           <label className="text-white text-sm font-semibold block mb-3">
             AWS region
diff --git a/frontend/src/models/system.js b/frontend/src/models/system.js
index 1039d6de25..4231c83c81 100644
--- a/frontend/src/models/system.js
+++ b/frontend/src/models/system.js
@@ -706,6 +706,30 @@ const System = {
     );
     return { viewable: isViewable, error: null };
   },
+
+  /**
+   * Validates a temporary auth token and logs in the user if the token is valid.
+   * @param {string} publicToken - the token to validate against
+   * @returns {Promise<{valid: boolean, user: import("@prisma/client").users | null, token: string | null, message: string | null}>}
+   */
+  simpleSSOLogin: async function (publicToken) {
+    return fetch(`${API_BASE}/request-token/sso/simple?token=${publicToken}`, {
+      method: "GET",
+    })
+      .then(async (res) => {
+        if (!res.ok) {
+          const text = await res.text();
+          if (!text.startsWith("{")) throw new Error(text);
+          return JSON.parse(text);
+        }
+        return await res.json();
+      })
+      .catch((e) => {
+        console.error(e);
+        return { valid: false, user: null, token: null, message: e.message };
+      });
+  },
+
   experimentalFeatures: {
     liveSync: LiveDocumentSync,
     agentPlugins: AgentPlugins,
diff --git a/frontend/src/pages/Login/SSO/simple.jsx b/frontend/src/pages/Login/SSO/simple.jsx
new file mode 100644
index 0000000000..1ceedcfb8e
--- /dev/null
+++ b/frontend/src/pages/Login/SSO/simple.jsx
@@ -0,0 +1,54 @@
+import React, { useEffect, useState } from "react";
+import { FullScreenLoader } from "@/components/Preloader";
+import { Navigate } from "react-router-dom";
+import paths from "@/utils/paths";
+import useQuery from "@/hooks/useQuery";
+import System from "@/models/system";
+import { AUTH_TIMESTAMP, AUTH_TOKEN, AUTH_USER } from "@/utils/constants";
+
+export default function SimpleSSOPassthrough() {
+  const query = useQuery();
+  const redirectPath = query.get("redirectTo") || paths.home();
+  const [ready, setReady] = useState(false);
+  const [error, setError] = useState(null);
+
+  useEffect(() => {
+    try {
+      if (!query.get("token")) throw new Error("No token provided.");
+
+      // Clear any existing auth data
+      window.localStorage.removeItem(AUTH_USER);
+      window.localStorage.removeItem(AUTH_TOKEN);
+      window.localStorage.removeItem(AUTH_TIMESTAMP);
+
+      System.simpleSSOLogin(query.get("token"))
+        .then((res) => {
+          if (!res.valid) throw new Error(res.message);
+
+          window.localStorage.setItem(AUTH_USER, JSON.stringify(res.user));
+          window.localStorage.setItem(AUTH_TOKEN, res.token);
+          window.localStorage.setItem(AUTH_TIMESTAMP, Number(new Date()));
+          setReady(res.valid);
+        })
+        .catch((e) => {
+          setError(e.message);
+        });
+    } catch (e) {
+      setError(e.message);
+    }
+  }, []);
+
+  if (error)
+    return (
+      <div className="w-screen h-screen overflow-hidden bg-sidebar flex items-center justify-center flex-col gap-4">
+        <p className="text-white font-mono text-lg">{error}</p>
+        <p className="text-white/80 font-mono text-sm">
+          Please contact the system administrator about this error.
+        </p>
+      </div>
+    );
+  if (ready) return <Navigate to={redirectPath} />;
+
+  // Loading state by default
+  return <FullScreenLoader />;
+}
diff --git a/server/.env.example b/server/.env.example
index 9c513f62f8..1995892780 100644
--- a/server/.env.example
+++ b/server/.env.example
@@ -280,4 +280,8 @@ TTS_PROVIDER="native"
 
 # Disable viewing chat history from the UI and frontend APIs.
 # See https://docs.anythingllm.com/configuration#disable-view-chat-history for more information.
-# DISABLE_VIEW_CHAT_HISTORY=1
\ No newline at end of file
+# DISABLE_VIEW_CHAT_HISTORY=1
+
+# Enable simple SSO passthrough to pre-authenticate users from a third party service.
+# See https://docs.anythingllm.com/configuration#simple-sso-passthrough for more information.
+# SIMPLE_SSO_ENABLED=1
diff --git a/server/endpoints/api/userManagement/index.js b/server/endpoints/api/userManagement/index.js
index 9b4e8c66f0..733e1d3139 100644
--- a/server/endpoints/api/userManagement/index.js
+++ b/server/endpoints/api/userManagement/index.js
@@ -1,5 +1,9 @@
 const { User } = require("../../../models/user");
+const { TemporaryAuthToken } = require("../../../models/temporaryAuthToken");
 const { multiUserMode } = require("../../../utils/http");
+const {
+  simpleSSOEnabled,
+} = require("../../../utils/middleware/simpleSSOEnabled");
 const { validApiKey } = require("../../../utils/middleware/validApiKey");
 
 function apiUserManagementEndpoints(app) {
@@ -59,6 +63,62 @@ function apiUserManagementEndpoints(app) {
       response.sendStatus(500).end();
     }
   });
+
+  app.get(
+    "/v1/users/:id/issue-auth-token",
+    [validApiKey, simpleSSOEnabled],
+    async (request, response) => {
+      /*
+      #swagger.tags = ['User Management']
+      #swagger.description = 'Issue a temporary auth token for a user'
+      #swagger.parameters['id'] = {
+        in: 'path',
+        description: 'The ID of the user to issue a temporary auth token for',
+        required: true,
+        type: 'string'
+      }
+      #swagger.responses[200] = {
+        content: {
+          "application/json": {
+            schema: {
+              type: 'object',
+              example: {
+                token: "1234567890",
+                loginPath: "/sso/simple?token=1234567890"
+              }
+            }
+          }
+        }
+      }
+    }
+    #swagger.responses[403] = {
+      schema: {
+        "$ref": "#/definitions/InvalidAPIKey"
+      }
+    }
+     #swagger.responses[401] = {
+      description: "Instance is not in Multi-User mode. Permission denied.",
+    }
+      */
+      try {
+        const { id: userId } = request.params;
+        const user = await User.get({ id: Number(userId) });
+        if (!user)
+          return response.status(404).json({ error: "User not found" });
+
+        const { token, error } = await TemporaryAuthToken.issue(userId);
+        if (error) return response.status(500).json({ error: error });
+
+        response.status(200).json({
+          token: String(token),
+          loginPath: `/sso/simple?token=${token}`,
+        });
+      } catch (e) {
+        console.error(e.message, e);
+        response.sendStatus(500).end();
+      }
+    }
+  );
 }
 
 module.exports = { apiUserManagementEndpoints };
diff --git a/server/endpoints/system.js b/server/endpoints/system.js
index 5e631b2f3f..6da117ff28 100644
--- a/server/endpoints/system.js
+++ b/server/endpoints/system.js
@@ -53,6 +53,8 @@ const { BrowserExtensionApiKey } = require("../models/browserExtensionApiKey");
 const {
   chatHistoryViewable,
 } = require("../utils/middleware/chatHistoryViewable");
+const { simpleSSOEnabled } = require("../utils/middleware/simpleSSOEnabled");
+const { TemporaryAuthToken } = require("../models/temporaryAuthToken");
 
 function systemEndpoints(app) {
   if (!app) return;
@@ -251,6 +253,49 @@ function systemEndpoints(app) {
     }
   });
 
+  app.get(
+    "/request-token/sso/simple",
+    [simpleSSOEnabled],
+    async (request, response) => {
+      const { token: tempAuthToken } = request.query;
+      const { sessionToken, token, error } =
+        await TemporaryAuthToken.validate(tempAuthToken);
+
+      if (error) {
+        await EventLogs.logEvent("failed_login_invalid_temporary_auth_token", {
+          ip: request.ip || "Unknown IP",
+          multiUserMode: true,
+        });
+        return response.status(401).json({
+          valid: false,
+          token: null,
+          message: `[001] An error occurred while validating the token: ${error}`,
+        });
+      }
+
+      await Telemetry.sendTelemetry(
+        "login_event",
+        { multiUserMode: true },
+        token.user.id
+      );
+      await EventLogs.logEvent(
+        "login_event",
+        {
+          ip: request.ip || "Unknown IP",
+          username: token.user.username || "Unknown user",
+        },
+        token.user.id
+      );
+
+      response.status(200).json({
+        valid: true,
+        user: User.filterFields(token.user),
+        token: sessionToken,
+        message: null,
+      });
+    }
+  );
+
   app.post(
     "/system/recover-account",
     [isMultiUserSetup],
diff --git a/server/models/systemSettings.js b/server/models/systemSettings.js
index dbc67d7018..dcf74db038 100644
--- a/server/models/systemSettings.js
+++ b/server/models/systemSettings.js
@@ -512,8 +512,11 @@ const SystemSettings = {
       GenericOpenAiKey: !!process.env.GENERIC_OPEN_AI_API_KEY,
       GenericOpenAiMaxTokens: process.env.GENERIC_OPEN_AI_MAX_TOKENS,
 
+      AwsBedrockLLMConnectionMethod:
+        process.env.AWS_BEDROCK_LLM_CONNECTION_METHOD || "iam",
       AwsBedrockLLMAccessKeyId: !!process.env.AWS_BEDROCK_LLM_ACCESS_KEY_ID,
       AwsBedrockLLMAccessKey: !!process.env.AWS_BEDROCK_LLM_ACCESS_KEY,
+      AwsBedrockLLMSessionToken: !!process.env.AWS_BEDROCK_LLM_SESSION_TOKEN,
       AwsBedrockLLMRegion: process.env.AWS_BEDROCK_LLM_REGION,
       AwsBedrockLLMModel: process.env.AWS_BEDROCK_LLM_MODEL_PREFERENCE,
       AwsBedrockLLMTokenLimit: process.env.AWS_BEDROCK_LLM_MODEL_TOKEN_LIMIT,
diff --git a/server/models/temporaryAuthToken.js b/server/models/temporaryAuthToken.js
new file mode 100644
index 0000000000..7f0c6b9f47
--- /dev/null
+++ b/server/models/temporaryAuthToken.js
@@ -0,0 +1,104 @@
+const { makeJWT } = require("../utils/http");
+const prisma = require("../utils/prisma");
+
+/**
+ * Temporary auth tokens are used for simple SSO.
+ * They simply enable the ability for a time-based token to be used in the query of the /sso/login URL
+ * to login as a user without the need of a username and password. These tokens are single-use and expire.
+ */
+const TemporaryAuthToken = {
+  expiry: 1000 * 60 * 6, // 1 hour
+  tablename: "temporary_auth_tokens",
+  writable: [],
+
+  makeTempToken: () => {
+    const uuidAPIKey = require("uuid-apikey");
+    return `allm-tat-${uuidAPIKey.create().apiKey}`;
+  },
+
+  /**
+   * Issues a temporary auth token for a user via its ID.
+   * @param {number} userId
+   * @returns {Promise<{token: string|null, error: string | null}>}
+   */
+  issue: async function (userId = null) {
+    if (!userId)
+      throw new Error("User ID is required to issue a temporary auth token.");
+    await this.invalidateUserTokens(userId);
+
+    try {
+      const token = this.makeTempToken();
+      const expiresAt = new Date(Date.now() + this.expiry);
+      await prisma.temporary_auth_tokens.create({
+        data: {
+          token,
+          expiresAt,
+          userId: Number(userId),
+        },
+      });
+
+      return { token, error: null };
+    } catch (error) {
+      console.error("FAILED TO CREATE TEMPORARY AUTH TOKEN.", error.message);
+      return { token: null, error: error.message };
+    }
+  },
+
+  /**
+   * Invalidates (deletes) all temporary auth tokens for a user via their ID.
+   * @param {number} userId
+   * @returns {Promise<boolean>}
+   */
+  invalidateUserTokens: async function (userId) {
+    if (!userId)
+      throw new Error(
+        "User ID is required to invalidate temporary auth tokens."
+      );
+    await prisma.temporary_auth_tokens.deleteMany({
+      where: { userId: Number(userId) },
+    });
+    return true;
+  },
+
+  /**
+   * Validates a temporary auth token and returns the session token
+   * to be set in the browser localStorage for authentication.
+   * @param {string} publicToken - the token to validate against
+   * @returns {Promise<{sessionToken: string|null, token: import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | null, error: string | null}>}
+   */
+  validate: async function (publicToken = "") {
+    /** @type {import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | undefined | null} **/
+    let token;
+
+    try {
+      if (!publicToken)
+        throw new Error(
+          "Public token is required to validate a temporary auth token."
+        );
+      token = await prisma.temporary_auth_tokens.findUnique({
+        where: { token: String(publicToken) },
+        include: { user: true },
+      });
+      if (!token) throw new Error("Invalid token.");
+      if (token.expiresAt < new Date()) throw new Error("Token expired.");
+      if (token.user.suspended) throw new Error("User account suspended.");
+
+      // Create a new session token for the user valid for 30 days
+      const sessionToken = makeJWT(
+        { id: token.user.id, username: token.user.username },
+        "30d"
+      );
+
+      return { sessionToken, token, error: null };
+    } catch (error) {
+      console.error("FAILED TO VALIDATE TEMPORARY AUTH TOKEN.", error.message);
+      return { sessionToken: null, token: null, error: error.message };
+    } finally {
+      // Delete the token after it has been used under all circumstances if it was retrieved
+      if (token)
+        await prisma.temporary_auth_tokens.delete({ where: { id: token.id } });
+    }
+  },
+};
+
+module.exports = { TemporaryAuthToken };
diff --git a/server/prisma/migrations/20241029203722_init/migration.sql b/server/prisma/migrations/20241029203722_init/migration.sql
new file mode 100644
index 0000000000..29ee89ad5a
--- /dev/null
+++ b/server/prisma/migrations/20241029203722_init/migration.sql
@@ -0,0 +1,12 @@
+-- CreateTable
+CREATE TABLE "temporary_auth_tokens" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "token" TEXT NOT NULL,
+    "userId" INTEGER NOT NULL,
+    "expiresAt" DATETIME NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "temporary_auth_tokens_userId_fkey" FOREIGN KEY ("userId") REFERENCES "users" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "temporary_auth_tokens_token_key" ON "temporary_auth_tokens"("token");
diff --git a/server/prisma/migrations/20241029233509_init/migration.sql b/server/prisma/migrations/20241029233509_init/migration.sql
new file mode 100644
index 0000000000..4540629ce0
--- /dev/null
+++ b/server/prisma/migrations/20241029233509_init/migration.sql
@@ -0,0 +1,5 @@
+-- CreateIndex
+CREATE INDEX "temporary_auth_tokens_token_idx" ON "temporary_auth_tokens"("token");
+
+-- CreateIndex
+CREATE INDEX "temporary_auth_tokens_userId_idx" ON "temporary_auth_tokens"("userId");
diff --git a/server/prisma/schema.prisma b/server/prisma/schema.prisma
index b4c086259e..dce62cad77 100644
--- a/server/prisma/schema.prisma
+++ b/server/prisma/schema.prisma
@@ -79,6 +79,7 @@ model users {
   slash_command_presets       slash_command_presets[]
   browser_extension_api_keys  browser_extension_api_keys[]
   hub_items                   hub_items[]
+  temporary_auth_tokens       temporary_auth_tokens[]
 }
 
 model recovery_codes {
@@ -324,3 +325,15 @@ model hub_items {
   user_id       Int?
   user          users?   @relation(fields: [user_id], references: [id], onDelete: Cascade)
 }
+
+model temporary_auth_tokens {
+  id        Int      @id @default(autoincrement())
+  token     String   @unique
+  userId    Int
+  expiresAt DateTime
+  createdAt DateTime @default(now())
+  user      users    @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([token])
+  @@index([userId])
+}
diff --git a/server/swagger/openapi.json b/server/swagger/openapi.json
index fb343ee836..1222b78b24 100644
--- a/server/swagger/openapi.json
+++ b/server/swagger/openapi.json
@@ -2877,6 +2877,65 @@
         }
       }
     },
+    "/v1/users/{id}/issue-auth-token": {
+      "get": {
+        "tags": [
+          "User Management"
+        ],
+        "description": "Issue a temporary auth token for a user",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "The ID of the user to issue a temporary auth token for"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "example": {
+                    "token": "1234567890",
+                    "loginPath": "/sso/simple?token=1234567890"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Instance is not in Multi-User mode. Permission denied."
+          },
+          "403": {
+            "description": "Forbidden",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InvalidAPIKey"
+                }
+              },
+              "application/xml": {
+                "schema": {
+                  "$ref": "#/components/schemas/InvalidAPIKey"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found"
+          },
+          "500": {
+            "description": "Internal Server Error"
+          }
+        }
+      }
+    },
     "/v1/openai/models": {
       "get": {
         "tags": [
diff --git a/server/utils/AiProviders/bedrock/index.js b/server/utils/AiProviders/bedrock/index.js
index c271f7297e..8d9be2d392 100644
--- a/server/utils/AiProviders/bedrock/index.js
+++ b/server/utils/AiProviders/bedrock/index.js
@@ -31,6 +31,14 @@ class AWSBedrockLLM {
     if (!process.env.AWS_BEDROCK_LLM_REGION)
       throw new Error("No AWS Bedrock LLM region was set.");
 
+    if (
+      process.env.AWS_BEDROCK_LLM_CONNECTION_METHOD === "sessionToken" &&
+      !process.env.AWS_BEDROCK_LLM_SESSION_TOKEN
+    )
+      throw new Error(
+        "No AWS Bedrock LLM session token was set while using session token as the authentication method."
+      );
+
     this.model =
       modelPreference || process.env.AWS_BEDROCK_LLM_MODEL_PREFERENCE;
     this.limits = {
@@ -41,6 +49,20 @@ class AWSBedrockLLM {
 
     this.embedder = embedder ?? new NativeEmbedder();
     this.defaultTemp = 0.7;
+    this.#log(
+      `Loaded with model: ${this.model}. Will communicate with AWS Bedrock using ${this.authMethod} authentication.`
+    );
+  }
+
+  /**
+   * Get the authentication method for the AWS Bedrock LLM.
+   * There are only two valid values for this setting - anything else will default to "iam".
+   * @returns {"iam"|"sessionToken"}
+   */
+  get authMethod() {
+    const method = process.env.AWS_BEDROCK_LLM_CONNECTION_METHOD || "iam";
+    if (!["iam", "sessionToken"].includes(method)) return "iam";
+    return method;
   }
 
   #bedrockClient({ temperature = 0.7 }) {
@@ -51,6 +73,9 @@ class AWSBedrockLLM {
       credentials: {
         accessKeyId: process.env.AWS_BEDROCK_LLM_ACCESS_KEY_ID,
         secretAccessKey: process.env.AWS_BEDROCK_LLM_ACCESS_KEY,
+        ...(this.authMethod === "sessionToken"
+          ? { sessionToken: process.env.AWS_BEDROCK_LLM_SESSION_TOKEN }
+          : {}),
       },
       temperature,
     });
diff --git a/server/utils/agents/aibitat/providers/bedrock.js b/server/utils/agents/aibitat/providers/bedrock.js
index 819dfc4053..6cdb92897a 100644
--- a/server/utils/agents/aibitat/providers/bedrock.js
+++ b/server/utils/agents/aibitat/providers/bedrock.js
@@ -22,6 +22,11 @@ class AWSBedrockProvider extends InheritMultiple([Provider, UnTooled]) {
       credentials: {
         accessKeyId: process.env.AWS_BEDROCK_LLM_ACCESS_KEY_ID,
         secretAccessKey: process.env.AWS_BEDROCK_LLM_ACCESS_KEY,
+        // If we're using a session token, we need to pass it in as a credential
+        // otherwise we must omit it so it does not conflict if using IAM auth
+        ...(this.authMethod === "sessionToken"
+          ? { sessionToken: process.env.AWS_BEDROCK_LLM_SESSION_TOKEN }
+          : {}),
       },
       model,
     });
@@ -31,6 +36,17 @@ class AWSBedrockProvider extends InheritMultiple([Provider, UnTooled]) {
     this.verbose = true;
   }
 
+  /**
+   * Get the authentication method for the AWS Bedrock LLM.
+   * There are only two valid values for this setting - anything else will default to "iam".
+   * @returns {"iam"|"sessionToken"}
+   */
+  get authMethod() {
+    const method = process.env.AWS_BEDROCK_LLM_CONNECTION_METHOD || "iam";
+    if (!["iam", "sessionToken"].includes(method)) return "iam";
+    return method;
+  }
+
   get client() {
     return this._client;
   }
diff --git a/server/utils/agents/ephemeral.js b/server/utils/agents/ephemeral.js
index 1ab2a988a2..d8258eca80 100644
--- a/server/utils/agents/ephemeral.js
+++ b/server/utils/agents/ephemeral.js
@@ -20,19 +20,40 @@ const {
  * not persist between invocations
  */
 class EphemeralAgentHandler extends AgentHandler {
+  /** @type {string|null} the unique identifier for the agent invocation */
   #invocationUUID = null;
+  /** @type {import("@prisma/client").workspaces|null} the workspace to use for the agent */
   #workspace = null;
+  /** @type {import("@prisma/client").users|null} the user id to use for the agent */
   #userId = null;
+  /** @type {import("@prisma/client").workspace_threads|null} the workspace thread id to use for the agent */
   #threadId = null;
+  /** @type {string|null} the session id to use for the agent */
   #sessionId = null;
+  /** @type {string|null} the prompt to use for the agent */
   #prompt = null;
+  /** @type {string[]} the functions to load into the agent (Aibitat plugins) */
   #funcsToLoad = [];
 
+  /** @type {AIbitat|null} */
   aibitat = null;
+  /** @type {string|null} */
   channel = null;
+  /** @type {string|null} */
   provider = null;
+  /** @type {string|null} the model to use for the agent */
   model = null;
 
+  /**
+   * @param {{
+   * uuid: string,
+   * workspace: import("@prisma/client").workspaces,
+   * prompt: string,
+   * userId: import("@prisma/client").users["id"]|null,
+   * threadId: import("@prisma/client").workspace_threads["id"]|null,
+   * sessionId: string|null
+   * }} parameters
+   */
   constructor({
     uuid,
     workspace,
@@ -148,8 +169,7 @@ class EphemeralAgentHandler extends AgentHandler {
     }
 
     // The provider was explicitly set, so check if the workspace has an agent model set.
-    if (this.invocation.workspace.agentModel)
-      return this.invocation.workspace.agentModel;
+    if (this.#workspace.agentModel) return this.#workspace.agentModel;
 
     // Otherwise, we have no model to use - so guess a default model to use via the provider
     // and it's system ENV params and if that fails - we return either a base model or null.
diff --git a/server/utils/helpers/updateENV.js b/server/utils/helpers/updateENV.js
index d705fb7306..6081159a52 100644
--- a/server/utils/helpers/updateENV.js
+++ b/server/utils/helpers/updateENV.js
@@ -213,6 +213,13 @@ const KEY_MAPPING = {
   },
 
   // AWS Bedrock LLM InferenceSettings
+  AwsBedrockLLMConnectionMethod: {
+    envKey: "AWS_BEDROCK_LLM_CONNECTION_METHOD",
+    checks: [
+      (input) =>
+        ["iam", "sessionToken"].includes(input) ? null : "Invalid value",
+    ],
+  },
   AwsBedrockLLMAccessKeyId: {
     envKey: "AWS_BEDROCK_LLM_ACCESS_KEY_ID",
     checks: [isNotEmpty],
@@ -221,6 +228,10 @@ const KEY_MAPPING = {
     envKey: "AWS_BEDROCK_LLM_ACCESS_KEY",
     checks: [isNotEmpty],
   },
+  AwsBedrockLLMSessionToken: {
+    envKey: "AWS_BEDROCK_LLM_SESSION_TOKEN",
+    checks: [],
+  },
   AwsBedrockLLMRegion: {
     envKey: "AWS_BEDROCK_LLM_REGION",
     checks: [isNotEmpty],
@@ -899,6 +910,8 @@ function dumpENV() {
     "HTTPS_KEY_PATH",
     // Other Configuration Keys
     "DISABLE_VIEW_CHAT_HISTORY",
+    // Simple SSO
+    "SIMPLE_SSO_ENABLED",
   ];
 
   // Simple sanitization of each value to prevent ENV injection via newline or quote escaping.
diff --git a/server/utils/middleware/simpleSSOEnabled.js b/server/utils/middleware/simpleSSOEnabled.js
new file mode 100644
index 0000000000..903200c037
--- /dev/null
+++ b/server/utils/middleware/simpleSSOEnabled.js
@@ -0,0 +1,39 @@
+const { SystemSettings } = require("../../models/systemSettings");
+
+/**
+ * Checks if simple SSO is enabled for issuance of temporary auth tokens.
+ * Note: This middleware must be called after `validApiKey`.
+ * @param {import("express").Request} request
+ * @param {import("express").Response} response
+ * @param {import("express").NextFunction} next
+ * @returns {void}
+ */
+async function simpleSSOEnabled(_, response, next) {
+  if (!("SIMPLE_SSO_ENABLED" in process.env)) {
+    return response
+      .status(403)
+      .send(
+        "Simple SSO is not enabled. It must be enabled to validate or issue temporary auth tokens."
+      );
+  }
+
+  // If the multi-user mode response local is not set, we need to check if it's enabled.
+  if (!("multiUserMode" in response.locals)) {
+    const multiUserMode = await SystemSettings.isMultiUserMode();
+    response.locals.multiUserMode = multiUserMode;
+  }
+
+  if (!response.locals.multiUserMode) {
+    return response
+      .status(403)
+      .send(
+        "Multi-User mode is not enabled. It must be enabled to use Simple SSO."
+      );
+  }
+
+  next();
+}
+
+module.exports = {
+  simpleSSOEnabled,
+};